What’s Vulnerable › Vulnerabilities

CVE-2019-14818

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-14 · updated 2026-06-17
• Weakness: CWE-401

Description

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

Affected products

• DPDK Data Plane Development Kit: from 16.04 before 16.11.10; from 17.02 before 17.11.8; from 18.02 before 18.11.4; from 19.02 before 19.08.1 — fixed in 16.11.10, 17.11.8, 18.11.4, 19.08.1
• Fedoraproject Fedora: 31
• RedHat Enterprise Linux Fast Datapath: 7.0, 8.0
• OpenStack: 10
• RedHat Virtualization Eus: 4.2

How to fix

Upgrade to a fixed version: DPDK Data Plane Development Kit 16.11.10, 17.11.8, 18.11.4, 19.08.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2020:0165
• https://access.redhat.com/errata/RHSA-2020:0166
• https://access.redhat.com/errata/RHSA-2020:0168
• https://access.redhat.com/errata/RHSA-2020:0171
• https://access.redhat.com/errata/RHSA-2020:0172
• https://bugs.dpdk.org/show_bug.cgi?id=363
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14818
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ULJ3C7OVBOEVDGSHYC3VCLSUHANGTFFP/
• https://access.redhat.com/errata/RHSA-2020:0165
• https://access.redhat.com/errata/RHSA-2020:0166
• https://access.redhat.com/errata/RHSA-2020:0168
• https://access.redhat.com/errata/RHSA-2020:0171

Get alerted when CVE-2019-14818 or the next vulnerability affects your stack